JVN#88315581: Multiple cross-site scripting vulnerabilities in Exment

Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in some input fields CWE-79 - CVE-2020-5619 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4...

PT-2020-3970

Name of the Vulnerable Software and Affected Versions: VMware App Volumes versions 2.x prior to 2.18.6 VMware App Volumes 4 versions prior to 2006 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. A malicious actor with access to create and edit applications or...

Cisco Vision Dynamic Signage Director Web Management Interface Cross-Site Scripting Vulnerability

Cisco Vision Dynamic Signage Director is an end-to-end dynamic signage and IPTV solution from Cisco USA. A cross-site scripting vulnerability exists in the Web management interface in Cisco Vision Dynamic Signage Director versions prior to 6.2 SP5, which stems from the program failing to properly...

Cisco DNA Center Cross-Site Scripting Vulnerability

Cisco DNA Center is the network management and command center for Cisco DNA. A cross-site scripting vulnerability exists in the Web management interface of Cisco DNA Center. The vulnerability stems from the web management interface failing to properly validate user-supplied input. An attacker cou...

CVE-2020-1182

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...

CVE-2020-1182: Undefined Security Weakness

A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...

CVE-2020-3463: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2020-64005)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A security...

Microsoft SharePoint Cross-Site Scripting Vulnerability (NVD-C-2020-180981)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6284

CVE-2020-6284 affects SAP NetWeaver Knowledge Management (versions 7.30, 7.31, 7.40, 7.50). The issue is a stored cross-site scripting (XSS) vulnerability caused by inadequate filtering when executing script content in a stored file. If an accessing user has administrative privileges, this could ...

PT-2020-13419

Name of the Vulnerable Software and Affected Versions RosarioSIS Student Information System versions prior to 6.5.1 Description The issue concerns a Reflected Cross-Site Scripting vulnerability. This allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in ...

PT-2020-14862

Name of the Vulnerable Software and Affected Versions SAINT Security Suite versions 8.0 through 9.8.20 Description A cross-site scripting XSS issue in the Credential Manager component could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafte...

PT-2020-14865

Name of the Vulnerable Software and Affected Versions SAINT Security Suite versions 8.0 through 9.8.20 Description A cross-site scripting XSS issue in the Permissions component could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link...

CVE-2020-16275: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link...

DEBIAN-CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...

CVE-2020-5613

Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL...

PT-2020-18583

Name of the Vulnerable Software and Affected Versions KonaWiki versions 2.2.0 and earlier Description A cross-site scripting issue allows remote attackers to execute an arbitrary script via a specially crafted URL. Recommendations For versions 2.2.0 and earlier, update to a version later than 2.2...

CVE-2020-5612: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL...